Selling Personal Information as a Cannabis Retailer: What You Need to Know

The Alcohol and Gaming Commission of Ontario (“AGCO”) recently published Guidance Document – Inducements Rules for Licensed Cannabis Retailers (the “Guidance Document”). The Guidance Document states that as of June 30, 2022, Ontario cannabis retailers will be allowed to sell personal customer information to licensed cannabis producers. However, they will still be expected to follow applicable privacy laws and regulations. This article discusses the current privacy law regime in Ontario and how cannabis retailers can legally collect and disclose personal information.

1 – Privacy Law for the Private Sector in Ontario

In Ontario, there is presently no provincial private sector privacy law, meaning the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies to most private sector organizations and businesses (including cannabis retailers and cannabis producers) in Ontario that are conducting "commercial activity," with commercial activity being defined very broadly. If a company is engaged in a “commercial activity,” it will likely fall under PIPEDA.¹  The law affects the way organizations collect, use and disclose personal information about individuals.

Given the fact that cannabis is illegal in jurisdictions outside of Canada, the personal information of cannabis users is arguably highly sensitive. The potential stigma associated with the purchase or use of cannabis, as well as risks associated with cross-border information transfers, mean that cannabis retailers must exercise caution before selling personal information to licensed cannabis producers and ensure that any personal information collected, used, stored or disclosed is properly handled.

2 – OPC Guidelines for the Use of Personal Information

The Office of the Privacy Commissioner of Canada (“OPC”) has previously published guidelines entitled, “Protecting Personal Information: Cannabis Transactions” (the “OPC Guidelines”), to clarify, amongst other things, the rights and obligations of both cannabis retailers and purchasers under PIPEDA. While the OPC Guidelines were published back in 2018, these Guidelines are still relevant especially in light of the AGOC Guidance Document that the AGOC just released. 

Cannabis retailers who would like to sell personal information of customers to licensed cannabis producers must consider the following:

1. Limit the collection of personal information to what is necessary

   Cannabis retailers should only collect personal information that a reasonable person would consider “appropriate under the circumstances.” They are also required to obtain prior informed consent from the customer before collecting any personal information.

   The guidelines provide an example where a retailer can request and review identification (e.g., a driver’s licence) to ensure that the consumer has reached the age of majority. However, there is no need to record this information. Also, medical information or other personal information is not required to purchase cannabis or cannabis products in person.

2. Obtain Meaningful Consent

   The general rule under PIPEDA is that consent must be obtained from an individual prior to the collection, use or disclosure of their personal information. Consent can be implied or express. If information at issue is sensitive and/or the collection, use or disclosure thereof is outside the reasonable expectations of the individual, then businesses will generally need to obtain express consent.²

   When a business is collecting personal information, it must inform the individual of the purpose(s) for which their information is being collected and disclosed.³ The collection of personal information must then be restricted to what is necessary for the purpose(s) that were identified.⁴ Similarly, businesses cannot use, disclose or retain the information for reasons other than the purpose(s) for which it was collected, unless the individual consents or they are otherwise required to do so by law.⁵

   Given the foregoing, if a cannabis retailer is planning to sell personal information to a cannabis producer, the cannabis retailer will need to obtain meaningful consent. The cannabis retailer will also need to clearly advise the individual at the time of collection that the information may be sold to a cannabis producer. 

3. Use appropriate safeguards for the storage of personal information

As a general proposition, the guidelines provide that any information collected from purchasers of cannabis must be stored in a secure manner by retailers. The OPC Guidelines highlight the following measures to be taken in order to comply with PIPEDA:

• Designate a privacy officer to be in charge of ensuring compliance with PIPEDA;
• Employ reasonable physical, organizational, and technological security measures to prevent any unauthorized access, collection, use or disclosure of personal information; and
• Develop and maintain appropriate policies and practices related to privacy.

In addition to using the sufficient security safeguards, if the cannabis retailer is planning to sell the personal information of customers to a cannabis producer, the cannabis retailer should enter into a written contract with the cannabis producer to ensure the cannabis producer will implement appropriate safeguards to protect the personal information.

For more information about legal considerations around cannabis, please contact a member of Torkin Manes’ Technology, Privacy & Data Management Group or Cannabis Group. 

---

1 See Personal Information Protection and Electronic Documents Act, S.C. 2000 c. 5 [PIPEDA] at s. 2(1) “commercial activity”.